Scanning at any real scale produces more results than anyone reads. Rules are how you mark the ones that matter, so the next person through the data does not have to rediscover what you already decided was interesting.
A rule watches scan and URL results, and when one matches, it applies your tags. It does not block, delete, or notify anything on its own. It labels, and you filter.
Encode what you already know to look for
The exposed management interface, the deprecated TLS version, the header your policy requires, the cookie set without the flags you expect: you know these when you see them. Write them once and every future result gets the same treatment automatically.
That is most of the value. A new finding arrives already tagged, instead of waiting for someone to notice it.
Match on more than the port
You can match on fields, headers, and cookies, and combine conditions so a rule is as specific as the thing you actually care about. Operators cover exact matches, contains, lists, and regular expressions, so a rule can be "port 22 anywhere" or something considerably narrower.
Where to go next
Rules covers the query shape and the operators. Search is how you pull the tagged results back out.